NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #580 by repository stars
Last release today
27 Oct 2026
Ships on a steady schedule
a new release about every 2 weeks
Rarely documented
notes for 4 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
15 years old
2914 releases · first in 2012
Fixes CVE-2026-97045 For golang/go#82622
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276)
for reporting this issue.
Fixes CVE-2026-97045
For golang/go#82622
Change-Id: I67d0006dce9023451905d8e96c4d1f3d05e769cc
Reviewed-on: https://go-internal-review.googlesource.com/c/net/+/6360
Reviewed-by: Nicholas Husin husin@google.com
Reviewed-by: Neal Patel nealpatel@google.com
Reviewed-on: https://go-review.googlesource.com/c/net/+/855121
Reviewed-by: Neal Patel neal@golang.org
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com golang-scoped@luci-project-accounts.iam.gserviceaccount.com
Auto-Submit: Gopher Robot gobot@golang.org
One column per quarter.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Fixes CVE-2026-97032 Fixes golang/go#81867
This is a backport CL for the equivalent change in std.
Fixes CVE-2026-97032
Fixes golang/go#81867
Change-Id: I8eaacd659f5d357b32699b63f726c4356a6a6964
Reviewed-on: https://go-review.googlesource.com/c/net/+/847188
Reviewed-by: Michael Pratt mpratt@google.com
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com golang-scoped@luci-project-accounts.iam.gserviceaccount.com
Reviewed-by: Dmitri Shuralyov dmitshur@google.com
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
internal/http3: fix wrong argument being given when validating header…
internal/http3: fix wrong argument being given when validating header…
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →